Re offline_access deprecation: When to do the fb_exchange_token thing?

Go To StackoverFlow.com

2

I'm tweaking a site that has been using FB authentication and access tokens for awhile to deal with the deprecation of offline_access, and, in particular, doing the fb_exchange_token thing to get extended-duration tokens for the site's users. It seems to be working, but I've got some questions. My basic approach is:

  • I get the user logged in through the usual server-side back-and-forth procedure, finally giving me a valid access token for the user. This works fine, and appears to be valid for 5300 seconds or so, like the standard/original tokens.

  • I then immediately do the fb_exchange_token call; this succeeds and gives me a new access_token that's good for a couple of months. This is the token that my site saves away for future use when it does things on behalf of the user.

This makes sense, right? It seems a little redundant to make one call right after another, but it's getting me the extended-lifespan token, which is what I want. I suppose I could use the original token for as long as it lasts and not bother with the exchange until the original token expires, but (a) it seems like I might as well get and use the extended one from the start and (b) it's not clear to me that an expired token can be exchanged for a extended-duration token.

So: Does anyone see any problems with this approach? Thanks!

2012-04-05 15:58
by Jim Miller


2

a) Yes, that approach works well. I do that with some of my apps.

b) Please see the 3rd item in this FAQ. http://dominicminicoopers.blogspot.com/2012/03/facebook-access-tokens-and-offline.html

Can I exchange my 60 day access token for a new 60 day access token?

No, sorry you cannot. You can only exchange a valid (meaning current) user access token for an extended one. You cannot extend an already extended access token.

2012-04-05 23:51
by DMCS
Right. But if I can insure that the user will have to log in again at some point before the extended token expires, they'll generate a new 5300-second token, which will in turn get exchanged for another extended token. Etc., etc., etc. I'm not trying to do any truly "offline" stuff; I just want the token to not expire while the user is logged into and using the site. And even if they somehow stay logged in beyond the duration of the extended token, I still have the old code to handle refreshing the original tokens. Anyway, thanks - Jim Miller 2012-04-06 06:07
Thanks @DMCS for that FAQ link. So it seems the docs are not only confusing but also wrong, as I read calling this multiple times during the same day will result only in the first call extending the expiration time as implying you can extend once per day. IMO this change will not deliver a good experience for mobile clients.. - Richard Barnett 2012-04-11 12:32


1

I've noticed today that for the token to actually be extended you have to disable the offline_token within your application settings. I was trying all day with this setting still enabled and I was only getting standard 2 hour tokens, the moment I disabled it, and tried again (after re-authenticating with FB) I got given a 2 month token. Hopes this saves people time (the documentation isn't very clear at all haha).

2012-04-16 22:54
by kernel-io
Good call here. I didn't realize I had to enable the extended token in my settings - Hawkee 2012-04-19 17:14


1

Why not just do something like this (much cleaner than doing all those explodes)?

$response = $this->facebook->api('/oauth/access_token', 'GET', array(
    'grant_type' => 'fb_exchange_token',
    'client_id' => $app_id,
    'client_secret' => $app_secret,
    'fb_exchange_token' => $access_token
));
parse_str($response, $output_array);
$long_lived_access_token = $output_array['access_token'];
$expires = $output_array['expires'];
2012-06-12 17:12
by Tim


0

Is this still working for people as of April 10th? I noticed yesterday our original tokens stopped being good for 60 days and so I implemented the fb_exchange_token call. But the response I get back is still only good for around 2 hours.. ie this:

access_token=AAAEHLUxxx...xx&expires=4404

I've been using the Android SDK to get the tokens, and my app has deprecated the offline_access permission. It was working good for about a week, all tokens used to last for 60 days.

2012-04-10 16:50
by Ryan
In my testing today, my original token has a 60-day expiry, and the extension response isn't modifying token or expiry. But I'm going to try to extend again tomorrow, and the day after, just to see what happens - Richard Barnett 2012-04-11 12:23
It's working for me on (11 April, 8 am PDT; web-based / PHP) -- the token I get a login is a "short one", but I'm able to exchange it for a "long one" - Jim Miller 2012-04-11 15:17
Weird. I'm using the server-side flow. When I enable the migration for my app, the access token has 60-day expiry & calling the extension API doesn't change it. When I disable the migration for the same app, the access token has 6200-second expiry, and calling the extension API doesn't change it either - Richard Barnett 2012-04-12 05:19


0

$url = "https://graph.facebook.com/oauth/access_token?client_id=$client_id&client_secret=$client_secret&grant_type=fb_exchange_token&fb_exchange_token=$fb_access_token";
$graph = file_get_contents($url);
$graph = explode("=", $graph);
$graph = explode("&", $graph[1]);
$new_access_token = $graph[0];
2012-04-19 15:00
by Emin Henri Mahrt
Ads